X-Git-Url: https://git.openstreetmap.org./rails.git/blobdiff_plain/3f698e1d1500f040897f497c2eb5259825a311cb..f02c753cc4ab882537ac75065c6c65605e8dc9fe:/app/controllers/notes_controller.rb?ds=sidebyside diff --git a/app/controllers/notes_controller.rb b/app/controllers/notes_controller.rb index 1366038f0..92f63e304 100644 --- a/app/controllers/notes_controller.rb +++ b/app/controllers/notes_controller.rb @@ -1,6 +1,7 @@ class NotesController < ApplicationController layout "site", :only => [:mine] + skip_before_action :verify_authenticity_token, :except => [:mine] before_action :check_api_readable before_action :authorize_web, :only => [:mine] before_action :setup_user_auth, :only => [:create, :comment] @@ -19,10 +20,10 @@ class NotesController < ApplicationController if params[:bbox] bbox = BoundingBox.from_bbox_params(params) else - raise OSM::APIBadUserInput.new("No l was given") unless params[:l] - raise OSM::APIBadUserInput.new("No r was given") unless params[:r] - raise OSM::APIBadUserInput.new("No b was given") unless params[:b] - raise OSM::APIBadUserInput.new("No t was given") unless params[:t] + raise OSM::APIBadUserInput, "No l was given" unless params[:l] + raise OSM::APIBadUserInput, "No r was given" unless params[:r] + raise OSM::APIBadUserInput, "No b was given" unless params[:b] + raise OSM::APIBadUserInput, "No t was given" unless params[:t] bbox = BoundingBox.from_lrbt_params(params) end @@ -55,9 +56,9 @@ class NotesController < ApplicationController raise OSM::APIAccessDenied if Acl.no_note_comment(request.remote_ip) # Check the arguments are sane - raise OSM::APIBadUserInput.new("No lat was given") unless params[:lat] - raise OSM::APIBadUserInput.new("No lon was given") unless params[:lon] - raise OSM::APIBadUserInput.new("No text was given") if params[:text].blank? + raise OSM::APIBadUserInput, "No lat was given" unless params[:lat] + raise OSM::APIBadUserInput, "No lon was given" unless params[:lon] + raise OSM::APIBadUserInput, "No text was given" if params[:text].blank? # Extract the arguments lon = OSM.parse_float(params[:lon], OSM::APIBadUserInput, "lon was not a number") @@ -68,7 +69,7 @@ class NotesController < ApplicationController Note.transaction do # Create the note @note = Note.create(:lat => lat, :lon => lon) - raise OSM::APIBadUserInput.new("The note is outside this world") unless @note.in_world? + raise OSM::APIBadUserInput, "The note is outside this world" unless @note.in_world? # Save the note @note.save! @@ -91,8 +92,8 @@ class NotesController < ApplicationController raise OSM::APIAccessDenied if Acl.no_note_comment(request.remote_ip) # Check the arguments are sane - raise OSM::APIBadUserInput.new("No id was given") unless params[:id] - raise OSM::APIBadUserInput.new("No text was given") if params[:text].blank? + raise OSM::APIBadUserInput, "No id was given" unless params[:id] + raise OSM::APIBadUserInput, "No text was given" if params[:text].blank? # Extract the arguments id = params[:id].to_i @@ -102,7 +103,7 @@ class NotesController < ApplicationController @note = Note.find(id) raise OSM::APINotFoundError unless @note raise OSM::APIAlreadyDeletedError.new("note", @note.id) unless @note.visible? - raise OSM::APINoteAlreadyClosedError.new(@note) if @note.closed? + raise OSM::APINoteAlreadyClosedError, @note if @note.closed? # Add a comment to the note Note.transaction do @@ -120,17 +121,17 @@ class NotesController < ApplicationController # Close a note def close # Check the arguments are sane - raise OSM::APIBadUserInput.new("No id was given") unless params[:id] + raise OSM::APIBadUserInput, "No id was given" unless params[:id] # Extract the arguments id = params[:id].to_i comment = params[:text] # Find the note and check it is valid - @note = Note.find_by_id(id) + @note = Note.find_by(:id => id) raise OSM::APINotFoundError unless @note raise OSM::APIAlreadyDeletedError.new("note", @note.id) unless @note.visible? - raise OSM::APINoteAlreadyClosedError.new(@note) if @note.closed? + raise OSM::APINoteAlreadyClosedError, @note if @note.closed? # Close the note and add a comment Note.transaction do @@ -150,17 +151,17 @@ class NotesController < ApplicationController # Reopen a note def reopen # Check the arguments are sane - raise OSM::APIBadUserInput.new("No id was given") unless params[:id] + raise OSM::APIBadUserInput, "No id was given" unless params[:id] # Extract the arguments id = params[:id].to_i comment = params[:text] # Find the note and check it is valid - @note = Note.find_by_id(id) + @note = Note.find_by(:id => id) raise OSM::APINotFoundError unless @note - raise OSM::APIAlreadyDeletedError.new("note", @note.id) unless @note.visible? || @user.moderator? - raise OSM::APINoteAlreadyOpenError.new(@note) unless @note.closed? || !@note.visible? + raise OSM::APIAlreadyDeletedError.new("note", @note.id) unless @note.visible? || current_user.moderator? + raise OSM::APINoteAlreadyOpenError, @note unless @note.closed? || !@note.visible? # Reopen the note and add a comment Note.transaction do @@ -205,7 +206,7 @@ class NotesController < ApplicationController # Read a note def show # Check the arguments are sane - raise OSM::APIBadUserInput.new("No id was given") unless params[:id] + raise OSM::APIBadUserInput, "No id was given" unless params[:id] # Find the note and check it is valid @note = Note.find(params[:id]) @@ -225,7 +226,7 @@ class NotesController < ApplicationController # Delete (hide) a note def destroy # Check the arguments are sane - raise OSM::APIBadUserInput.new("No id was given") unless params[:id] + raise OSM::APIBadUserInput, "No id was given" unless params[:id] # Extract the arguments id = params[:id].to_i @@ -255,7 +256,7 @@ class NotesController < ApplicationController # Return a list of notes matching a given string def search # Check the arguments are sane - raise OSM::APIBadUserInput.new("No query string was given") unless params[:q] + raise OSM::APIBadUserInput, "No query string was given" unless params[:q] # Get any conditions that need to be applied @notes = closed_condition(Note.all) @@ -277,15 +278,16 @@ class NotesController < ApplicationController # Display a list of notes by a specified user def mine if params[:display_name] - if @this_user = User.active.find_by_display_name(params[:display_name]) + if @this_user = User.active.find_by(:display_name => params[:display_name]) + @params = params.permit(:display_name) @title = t "note.mine.title", :user => @this_user.display_name @heading = t "note.mine.heading", :user => @this_user.display_name @description = t "note.mine.subheading", :user => render_to_string(:partial => "user", :object => @this_user) @page = (params[:page] || 1).to_i @page_size = 10 @notes = @this_user.notes - @notes = @notes.visible unless @user && @user.moderator? - @notes = @notes.order("updated_at DESC, id").uniq.offset((@page - 1) * @page_size).limit(@page_size).preload(:comments => :author).to_a + @notes = @notes.visible unless current_user && current_user.moderator? + @notes = @notes.order("updated_at DESC, id").distinct.offset((@page - 1) * @page_size).limit(@page_size).preload(:comments => :author).to_a else @title = t "user.no_such_user.title" @not_found_user = params[:display_name] @@ -308,7 +310,7 @@ class NotesController < ApplicationController if params[:limit].to_i > 0 && params[:limit].to_i <= 10000 params[:limit].to_i else - raise OSM::APIBadUserInput.new("Note limit must be between 1 and 10000") + raise OSM::APIBadUserInput, "Note limit must be between 1 and 10000" end else 100 @@ -339,16 +341,16 @@ class NotesController < ApplicationController def add_comment(note, text, event, notify = true) attributes = { :visible => true, :event => event, :body => text } - if @user - attributes[:author_id] = @user.id + if current_user + attributes[:author_id] = current_user.id else attributes[:author_ip] = request.remote_ip end - comment = note.comments.create(attributes) + comment = note.comments.create!(attributes) note.comments.map(&:author).uniq.each do |user| - if notify && user && user != @user && user.visible? + if notify && user && user != current_user && user.visible? Notifier.note_comment_notification(comment, user).deliver_now end end